Roo+ v3.88.15

[3.88.0] — 2026-09-09

Minor — Privacy, Trust & Reproducible Source

Starting the 3.88 pre-release line — a hardening cycle responding to VS Code Marketplace notice #305. Roo+ is now fully telemetry-free and reproducible from committed source, and sensitive operations are gated by explicit workspace trust and consent. The line iterates with v3.88.1, v3.88.2 and v3.88.3, which fix the webview reliability issues tracked in #64, #328 and #331.

📣 What's New

• 🕵️ Zero telemetry by design — PostHog removed entirely; Roo+ reports nothing, and builds are reproducible with no secrets
• 🔐 Trust-gated operations — sensitive commands require workspace trust; first-use binary downloads require your explicit consent
• 🧊 No more gray, frozen webview — state updates no longer ship your full task history to the webview, so it stays responsive over remote links (v3.88.1)
• 📉 Large-state warning gone — the multi-MB task-history mirror is no longer written into VS Code global state (v3.88.1)
• 🧹 Quieter developer consoles — Semble search logs moved to the output channel, and production source-map 404 noise stopped (v3.88.1)

🔒 Security & Privacy

• Fully private by design — PostHog telemetry removed entirely (client, TelemetryService, all capture call sites, webview TelemetryClient/Banner/About, and telemetrySetting/machineId/telemetryKey state and schemas); packages/telemetry and POSTHOG_API_KEY build-time injection are dropped so builds are reproducible with no secrets.
• Trusted-workspace gating — capabilities.untrustedWorkspaces.supported=false with restrictedConfigurations for command settings; runtime isTrusted/requestWorkspaceTrust gates at task start, terminal execution, and auto-approval.
• Consent-gated binary downloads — first-use Semble and DCG acquisition requires fail-closed consent (Allow once / Always allow / Deny) persisted only on explicit choice and never in an untrusted workspace, with version-scoped approval.
• Reproducible, secret-free builds — every VSIX is verified byte-for-byte from committed source; Semble and DCG release-governance records disclose external authorship, pinned versions, and checksums.
• Source-matching & audit tooling — vsix-audit.mjs + by-design register retained as an optional on-demand scan (not a publish gate); SECURITY.md records the post-fix reproducible-VSIX measurement.
• Docs privacy guard broadened — scripts/verify-docs-no-public-ip.mjs now scans repo Markdown (not only the incidents/postmortems subset) for public IPv4 literals and internal hostnames, is wired into the Code QA static-analysis job, and is covered by unit tests — the follow-up to the 3.88.8 docs disclosure of a remote IP and hostnames.

🩺 Webview Reliability — v3.88.1 / v3.88.2 / v3.88.3 (#64, #328, #331)

• Bounded task-history payloads — the full taskHistory mirror is no longer shipped inside every state/taskHistoryUpdated message, and it is no longer written through to the taskHistory Memento key; the webview receives a capped recent-tasks list while per-task files remain the source of truth. This fixes the pale-gray frozen webview over remote links and the "large extension state" DevTools warning (#64).
• Bounded customModes payloads — the ~740 KB, 90-mode custom-modes catalog is no longer shipped inside every host→webview state push; the webview receives a bounded projection (custom instructions stripped, active and last-edited modes kept full) and lazy-fetches mode bodies on edit, while the legacy customModes global-state mirror is cleared on startup like taskHistory (#328).
• Bounded chat-message payloads — the last unbounded host→webview field (clineMessages) now ships a tail-anchored, byte-bounded projection (~690 KB → ~141 KB per push) with a lazy "load earlier messages" path, so reopening a long task no longer rehydrates its whole transcript over remote-SSH IPC (#331).
• Payload-SLI probe guard + host-health instrumentation — the payload SLI now decides WARN/ERROR from an O(n) byte proxy and only stringifies on the alert path (~98.7% less hot-path monitoring CPU; alerts still classified on exact bytes, so no false popup), and a log-only extension-host health probe (ROO_HOST_HEALTH_DEBUG, off by default; no persistence, no egress) plus scripts/host-health-capture.sh and a runbook capture template attribute "Extension host (Remote) is unresponsive" (#331).
• Payload-size SLI — host→webview state messages are now measured with size thresholds, so a payload regression surfaces in logs before users feel it (#64).
• Quieter consoles — Semble search logging moved behind the extension output channel, and production source-map URL guessing (guaranteed 404 noise) is gated behind a debug flag (#64).

🩺 Webview Reliability — v3.88.4 … v3.88.8 (#331)

• Byte-bounded taskHistory — the count-only cap (100 rows ≈ 1 MB on a history-heavy install) now also has a 32 KB byte budget with a 3-row floor, and the newest row is never dropped, so the state payload stays clear of the 1 MB ERROR threshold and the warning popup. The History panel lazy-loads the omitted tail ("Load older tasks") instead of the host re-serializing ~1 MB on every push (#331).
• Bounded-window metadata — taskHistoryBounded, taskHistoryTotal and taskHistoryPagingAnchorTs let the panel tell a truncated list from a short one and page from the correct cutoff, so rows skipped by the byte budget stay reachable (#331).
• Tree-safe window — a byte/count boundary no longer splits a parent/child task tree: the window re-attaches the ancestor rows a subtask needs, so a subtask is never rendered as a top-level task (#331).
• Renderer-liveness probe ([webview-liveness]) — opt-in, log-only host→webview→host ping/pong probe reporting RTT p50/p99/max and missed pongs once per ~60 s window, plus WARN/ERROR lines past the documented thresholds. Enabled with ROO_WEBVIEW_LIVENESS_DEBUG=1, off by default, local-only and never persisted. [host-health] instruments the extension host and cannot see a stalled webview renderer/transport, which is what the 2026-09-18 gray-webview capture shows (#331).
• Hermetic health-metrics tests — the host-health gate specs no longer depend on the developer's ambient ROO_HOST_HEALTH_DEBUG, so they pass with the flag set or unset (DEBT E).

🩺 Webview Reliability — v3.88.9 (#359)

• Per-workspace history scope — Workspace: Current (the default) now computes the count/byte-bounded taskHistory window over the active workspace's tasks instead of truncating the global pool and filtering afterwards, so a multi-workspace install no longer collapses to a single row when Current is selected (#359).
• Scope-aware, advancing paging — "Load older tasks" pages from an advancing, scope-aware anchor (omitting beforeTs fetches the scope's first page on switch/reset), and a background taskHistoryUpdated push now merges into the list instead of replacing it, so paging is no longer reset by unrelated updates (#359).
• Byte bound preserved per scope — the 32 KB budget / 3-row floor / tree-closure projection is applied within each scope, so the 3.88.8 gray-out fix is not re-opened; a composite <256 KB state payload budget guard covers the whole message (#359).
• Paging observability — payload WARN/ERROR lines are tagged scope=current|all, and a log-only [webview-metrics] history_paging line records rows/bytes/hasMore (no content), so "Load older tasks seemed broken" is measurable (#359).

🔄 Upstream Sync & Core Hardening — v3.88.10 … v3.88.13 (#410, #362)

• Webview boot hardening (#362) — a nonce'd inline boot guard (watchdog + error/unhandledrejection fast paths, self-contained Reload fallback disarmed by webviewDidLaunch), a late-mount fallback with a bounded poll, a self-defending entry mount and outer ErrorBoundary, malformed-state salvage hydration with a timeout, corrected send/drop accounting, resource_errors/state_drops/salvaged_states liveness counters, and host-side rate limiting for webviewBootFailure notifications, plus an extension-host webview-boot smoke test.
• Inline terminal shell fidelity — getShell() now reports the shell that actually runs (zsh / PowerShell profile / cmd), the host UTF-8 locale is inherited instead of forcing en_US.UTF-8, and the inline terminal no longer falls back to cmd.exe on Windows (Zoo-Code-Org#1682, Zoo-Code-Org#1713, Zoo-Code-Org#1673).
• VS Code LM robustness — lone UTF-16 surrogates are sanitized in message text, tool-call/result ids and the system prompt before a request is sent, so the backend no longer rejects the whole request with a 400 (Zoo-Code-Org#1605).
• Provider routing & cost reporting — reasoning chunks are yielded before content chunks to stop streaming truncation, Gemini CLI handler routing is explicit, OpenCode Go routes gpt-5.6-luna via /v1/responses, sends the conversation session header and reports corrected context limits, and the router no longer invents UI cost from default model prices (Zoo-Code-Org#1462, Zoo-Code-Org#1442, Zoo-Code-Org#1443, Zoo-Code-Org#1512, Zoo-Code-Org#1428, Zoo-Code-Org#1339).
• Qdrant code-index core re-synced — orchestration scan execution, service factories + embedder validation, single-file preparation and immutable configuration snapshots are forward-ported from upstream while keeping the fork's telemetry purge, so the core stays cherry-pickable and the upstream-alignment gate is green.
• Release & dependency hardening — the fail-closed pre-release guard chain, cross-registry duplicate checks and provenance gates are enforced on master, and high-severity advisories are pinned (axios ≥ 1.20.0, fast-uri ≥ 3.1.7, undici ≥ 6.28.1, brace-expansion ≥ 5.0.11).

Roo+ v3.88.11

[3.88.0] — 2026-09-09

Minor — Privacy, Trust & Reproducible Source

Starting the 3.88 pre-release line — a hardening cycle responding to VS Code Marketplace notice #305. Roo+ is now fully telemetry-free and reproducible from committed source, and sensitive operations are gated by explicit workspace trust and consent. The line iterates with v3.88.1, v3.88.2 and v3.88.3, which fix the webview reliability issues tracked in #64, #328 and #331.

📣 What's New

• 🕵️ Zero telemetry by design — PostHog removed entirely; Roo+ reports nothing, and builds are reproducible with no secrets
• 🔐 Trust-gated operations — sensitive commands require workspace trust; first-use binary downloads require your explicit consent
• 🧊 No more gray, frozen webview — state updates no longer ship your full task history to the webview, so it stays responsive over remote links (v3.88.1)
• 📉 Large-state warning gone — the multi-MB task-history mirror is no longer written into VS Code global state (v3.88.1)
• 🧹 Quieter developer consoles — Semble search logs moved to the output channel, and production source-map 404 noise stopped (v3.88.1)

🔒 Security & Privacy

• Fully private by design — PostHog telemetry removed entirely (client, TelemetryService, all capture call sites, webview TelemetryClient/Banner/About, and telemetrySetting/machineId/telemetryKey state and schemas); packages/telemetry and POSTHOG_API_KEY build-time injection are dropped so builds are reproducible with no secrets.
• Trusted-workspace gating — capabilities.untrustedWorkspaces.supported=false with restrictedConfigurations for command settings; runtime isTrusted/requestWorkspaceTrust gates at task start, terminal execution, and auto-approval.
• Consent-gated binary downloads — first-use Semble and DCG acquisition requires fail-closed consent (Allow once / Always allow / Deny) persisted only on explicit choice and never in an untrusted workspace, with version-scoped approval.
• Reproducible, secret-free builds — every VSIX is verified byte-for-byte from committed source; Semble and DCG release-governance records disclose external authorship, pinned versions, and checksums.
• Source-matching & audit tooling — vsix-audit.mjs + by-design register retained as an optional on-demand scan (not a publish gate); SECURITY.md records the post-fix reproducible-VSIX measurement.
• Docs privacy guard broadened — scripts/verify-docs-no-public-ip.mjs now scans repo Markdown (not only the incidents/postmortems subset) for public IPv4 literals and internal hostnames, is wired into the Code QA static-analysis job, and is covered by unit tests — the follow-up to the 3.88.8 docs disclosure of a remote IP and hostnames.

🩺 Webview Reliability — v3.88.1 / v3.88.2 / v3.88.3 (#64, #328, #331)

• Bounded task-history payloads — the full taskHistory mirror is no longer shipped inside every state/taskHistoryUpdated message, and it is no longer written through to the taskHistory Memento key; the webview receives a capped recent-tasks list while per-task files remain the source of truth. This fixes the pale-gray frozen webview over remote links and the "large extension state" DevTools warning (#64).
• Bounded customModes payloads — the ~740 KB, 90-mode custom-modes catalog is no longer shipped inside every host→webview state push; the webview receives a bounded projection (custom instructions stripped, active and last-edited modes kept full) and lazy-fetches mode bodies on edit, while the legacy customModes global-state mirror is cleared on startup like taskHistory (#328).
• Bounded chat-message payloads — the last unbounded host→webview field (clineMessages) now ships a tail-anchored, byte-bounded projection (~690 KB → ~141 KB per push) with a lazy "load earlier messages" path, so reopening a long task no longer rehydrates its whole transcript over remote-SSH IPC (#331).
• Payload-SLI probe guard + host-health instrumentation — the payload SLI now decides WARN/ERROR from an O(n) byte proxy and only stringifies on the alert path (~98.7% less hot-path monitoring CPU; alerts still classified on exact bytes, so no false popup), and a log-only extension-host health probe (ROO_HOST_HEALTH_DEBUG, off by default; no persistence, no egress) plus scripts/host-health-capture.sh and a runbook capture template attribute "Extension host (Remote) is unresponsive" (#331).
• Payload-size SLI — host→webview state messages are now measured with size thresholds, so a payload regression surfaces in logs before users feel it (#64).
• Quieter consoles — Semble search logging moved behind the extension output channel, and production source-map URL guessing (guaranteed 404 noise) is gated behind a debug flag (#64).

🩺 Webview Reliability — v3.88.4 … v3.88.8 (#331)

• Byte-bounded taskHistory — the count-only cap (100 rows ≈ 1 MB on a history-heavy install) now also has a 32 KB byte budget with a 3-row floor, and the newest row is never dropped, so the state payload stays clear of the 1 MB ERROR threshold and the warning popup. The History panel lazy-loads the omitted tail ("Load older tasks") instead of the host re-serializing ~1 MB on every push (#331).
• Bounded-window metadata — taskHistoryBounded, taskHistoryTotal and taskHistoryPagingAnchorTs let the panel tell a truncated list from a short one and page from the correct cutoff, so rows skipped by the byte budget stay reachable (#331).
• Tree-safe window — a byte/count boundary no longer splits a parent/child task tree: the window re-attaches the ancestor rows a subtask needs, so a subtask is never rendered as a top-level task (#331).
• Renderer-liveness probe ([webview-liveness]) — opt-in, log-only host→webview→host ping/pong probe reporting RTT p50/p99/max and missed pongs once per ~60 s window, plus WARN/ERROR lines past the documented thresholds. Enabled with ROO_WEBVIEW_LIVENESS_DEBUG=1, off by default, local-only and never persisted. [host-health] instruments the extension host and cannot see a stalled webview renderer/transport, which is what the 2026-09-18 gray-webview capture shows (#331).
• Hermetic health-metrics tests — the host-health gate specs no longer depend on the developer's ambient ROO_HOST_HEALTH_DEBUG, so they pass with the flag set or unset (DEBT E).

🩺 Webview Reliability — v3.88.9 (#359)

• Per-workspace history scope — Workspace: Current (the default) now computes the count/byte-bounded taskHistory window over the active workspace's tasks instead of truncating the global pool and filtering afterwards, so a multi-workspace install no longer collapses to a single row when Current is selected (#359).
• Scope-aware, advancing paging — "Load older tasks" pages from an advancing, scope-aware anchor (omitting beforeTs fetches the scope's first page on switch/reset), and a background taskHistoryUpdated push now merges into the list instead of replacing it, so paging is no longer reset by unrelated updates (#359).
• Byte bound preserved per scope — the 32 KB budget / 3-row floor / tree-closure projection is applied within each scope, so the 3.88.8 gray-out fix is not re-opened; a composite <256 KB state payload budget guard covers the whole message (#359).
• Paging observability — payload WARN/ERROR lines are tagged scope=current|all, and a log-only [webview-metrics] history_paging line records rows/bytes/hasMore (no content), so "Load older tasks seemed broken" is measurable (#359).

Roo+ v3.87.3

[3.87.0] — 2026-08-27

Minor — Milestone Two: Local-First & Agentic

Starting the 3.87 pre-release line. Milestone two begins now — guided by your feedback, we're doubling down on building a local-first, agentic IDE extension that makes your AI spend legible and your knowledge portable.

🎉 Announcement

• 🎉 Milestone one is a wrap — a stable release, 300+ modes, and a clear roadmap for the road ahead. We couldn't be more excited about what's next.
• 🚀 Milestone two begins now — guided by your feedback, we're doubling down on building a local-first, agentic IDE extension that makes your AI spend legible and your knowledge portable.
• ❤️ To our 7.6k active users — thank you for choosing Roo+ and sharing this milestone with us. We're honored to have you on board — and we can't wait for the journey ahead.

Roo+ v3.84.0

[3.84.0] — 2026-08-25

Minor — Red-Team Mode, Marketplace Expansion & Release Polish

🚀 Enhancements

• Red-team mode added to the Mode Marketplace — Add 🔴 Red Team Mode, a structured, constructive adversary that stress-tests proposals by attacking assumptions, building attack trees, running failure-mode analysis, and pairing every finding with concrete hardening options (#255). The canonical catalog grows to 302 modes (90 pre-loaded).
• Marketplace links surfaced in the README — Add prominent Open VSX and VS Code Marketplace links to the README header so users can find and install the extension directly (#266).

🐛 Bug Fixes

• What's New popup re-arms per version — The announcement popup's identity is now derived from the extension version instead of a manually-maintained literal, so it reliably reappears after every version bump instead of being suppressed after the first release (#265).

Roo+ v3.83.0

[3.83.0] — 2026-08-25

Minor — Provider Expansion, Diff UX & Shell Auto-Approval Hardening

🚀 Enhancements

• GLM-5.2 support with High/Max reasoning_effort tiers — Add GLM-5.2 support with High/Max reasoning_effort tiers. The default effort is High (deep reasoning stays opt-in), Max is selected only when the user explicitly picks it, and the parameter is omitted entirely when reasoning is disabled. Also refines the Opencode Go provider per review: bill MiniMax M3 cache writes (cacheWritesPrice), expose the max-output slider for DeepSeek V4 models (supportsMaxTokens), wrap pre-stream Anthropic-format errors with the provider prefix, and type the Anthropic streaming path's model info as ModelInfo so cost calculation can no longer silently return $0.
• Settings to control auto-closing editor tabs after diff edits — Add settings to control whether editor tabs Zoo opens during diff edits are auto-closed after accept/reject: auto-close transiently-opened files, auto-close even after user interaction (a refinement of the first), and auto-close newly created files.
• Forward task ID to LiteLLM proxies as X-Zoo-Session-ID — Forward the active task ID to the LiteLLM proxy as an X-Zoo-Session-ID request header so individual conversations can be correlated in LiteLLM logs and spend tracking. The header is only sent when a task ID is present, and follows the x-<vendor>-session-id convention used by Claude Code (x-claude-code-session-id) and GitHub Copilot (x-copilot-session-id).
• Enhanced apply_diff tool instructions for smaller models — Enhance the apply_diff tool description and parameter instructions to recommend :start_line: with exact syntax and emphasize copy-paste exact matching requirements, improving success rates for Gemini Flash and other smaller/faster models.
• apiRequestTimeout validation hardened — Updated apiRequestTimeout validation. Values must be integers between 1 and 3600 seconds; invalid or out-of-range values, including 0, now fall back to 600 seconds. This aligns with the SDK's default timeout value.

🐛 Bug Fixes

• Anthropic provider honors custom model IDs — Fix the Anthropic provider silently replacing a custom/unrecognized apiModelId with the hardcoded default model. AnthropicHandler.getModel() coerced any apiModelId not present in the static anthropicModels table down to anthropicDefaultModelId ("claude-sonnet-4-5"), silently ignoring a user-configured custom model name (e.g. a custom Anthropic-compatible deployment or proxy). The same fallback also affected capability lookups used to build the thinking request parameter. The model id sent to the API now always honors a user-configured apiModelId; for unrecognized values, capabilities are best-effort guessed by matching known model-family substrings (mirroring the existing BedrockHandler.guessModelInfoFromId heuristic).
• Diff view scroll position and tab handling restored — Fix diff view scroll position and tab handling when applying edits. The diff now opens scrolled to the first changed line (including end-of-file removals) instead of forcing the viewport to the top. After accepting or rejecting a diff, files that were already open are restored to their pre-edit scroll position, and files that were not open before the edit have their transiently opened tab closed — unless the user activated that tab during the diff, in which case it is kept open. Focus is no longer pulled back to the edited file when the user has navigated elsewhere. Preview-tab and pinned-tab states are preserved across the edit.
• LiteLLM cache key collision and model-selection desync fixed — Fix LiteLLM provider cache key collision, credential priority, and model-selection fallback to a non-existent default. URL-scoped providers (LiteLLM, Ollama, LM Studio, Poe, DeepSeek, Requesty) previously shared one cache entry keyed only on the provider name; they now use a compound provider:baseUrl key plus an irreversible API-key discriminator so switching profiles never serves a stale model list. The silent fallback to the hardcoded claude-3-7-sonnet-20250219 default is removed: the configured model ID is preserved when the list is empty, the router-models cache is invalidated after "Sync Models", current credentials are passed in the debounced requestRouterModels message, and message values take precedence over stale saved config.
• Command auto-approval for multi-line quoted constructs and heredocs fixed — Fix command auto-approval for multi-line shell constructs that must be treated as a single command. Quoted multi-line arguments (sh -c '...', $'...', "..."), heredocs (<< EOF, << 'EOF', etc.), and locale quoting ($"...") are now masked before the newline split so embedded newlines and operators stay within their command; quote masking is comment-aware; and unterminated quotes/heredocs are returned as single opaque tokens. The command pattern breakdown UI now uses the same quote- and heredoc-aware parser.
• Bedrock DNS resolution fixed behind corporate proxies — Fix Bedrock DNS resolution when behind a corporate proxy.

Roo+ v3.81.0

[3.81.0] — 2026-08-21

Patch — Webview Reliability, Pre-Release Channel Hardening & Release Governance Cleanup

🐛 Bug Fixes

• Webview React #301 startup crash and seen-set churn resolved (Closes: #250) — The webview production build compiled with the React Compiler while the vitest suite did not, so the #245 render-loop fix regressed under the compiler's auto-memoization. babel-plugin-react-compiler is now disabled in the production and component-test webview builds (with a new CI toolchain-parity gate that canaries the production bundle), and the seenTsStore LRU churn is fixed: with >100 messages the capacity-bounded LRU evicted already-seen timestamps, un-hiding messages and causing an endless render → effect → render cycle. Replaced with a Set bounded by the current message set via the existing 60s prune, with regression tests for the startup path, >100-message churn, and store prune cases.
• Render-phase setState loops eliminated (Closes: #245) — React error #301 ("Too many re-renders") in 3.81.0-pre-release.4 was introduced by commit f8505866f, which converted effect-based state sync into render-phase "adjust state during render" setState across the webview; non-convergent guards caused an infinite render loop on startup. Replaced every unsafe guard with loop-safe patterns: a new usePrimitiveSync hook for value-stable primitives, stable derived string keys for object/array props and context objects, useSyncExternalStore for the ChatView seen-set, and effect-based sync where render-phase setState is not expressible safely. Behavioral fixes: the announcement no longer re-shows immediately after dismissal, settings-import navigation converges, CodeIndexPopover no longer clobbers user edits on every extension-state push, and UpdateTodoListToolBlock no longer regenerates todo IDs on reference churn.

🔧 Chores

• Open VSX pre-release marker stamped into packaged manifest (Closes: #243) — vsce package --pre-release only writes Microsoft.VisualStudio.Code.PreRelease to the XML extension.vsixmanifest, and the ovsx CLI ignores --pre-release for pre-built VSIX files, so Open VSX was flagging pre-releases as stable. The marker is now stamped into src/package.json during the pre-release version step and asserted before publishing so a regression fails loudly (bug #243).
• Pre-release publish fails loudly with notifications (PR #244 by @xavier-arosemena) — The pre-release publish workflow previously reported success even when no marketplace token was configured, silently publishing nothing. A fail-fast token guard now turns the run red when both VSCE_PAT and OVSX_PAT are missing, and the existing Slack notify action is wired in so publish failures trigger a notification.
• Stale release-governance docs and announcement visualization removed — docs/RELEASE-WORKFLOWS.md, docs/SEMBLE-RELEASE-GOVERNANCE.md, sembleexec-release-guard.yml, and announcement-visualization.html (no longer referenced anywhere in the repository) were removed as part of the release-cycle cleanup.
• CI audit, submodule checkout, and RooHero visual snapshot fixed (PR #241 by @xavier-arosemena) — pnpm-workspace.yaml gains patched js-yaml overrides (CVE-2026-59870) and a nanoid >=3.3.18 override (GHSA-2v37-7h3g-55p8) to fix the audit-dependencies job; code-qa.yml checks out the custom-modes submodule recursively in the unit-test job so verify-submodule-pin passes; and the zoo-hero-dark.png visual snapshot was regenerated after the welcome-screen ASCII-figlet redesign (Issue #196).

Roo+ v3.77.4

[3.77.4] — 2026-08-07

Patch — Initial Webview Redesign & Webview/Marketplace Reliability

🚀 Enhancements

• Redesigned initial welcome screen (Closes: #172) — The welcome screen tips panel (RooTips.tsx) is replaced with an intro line sourced from the extension description plus functional community links — Report issue, Discussions, Star on GitHub, and Review on Open VSX — wired through the openExternal pattern. New links are centralized in externalLinks.ts; the stale docs link and old tips copy were removed. All strings are localized across all 18 webview locales, and the marketplace description count is synced (301 specialized modes).
• In-extension release announcement overhauled (Closes: #38) — The four announcement layers are now in sync for v3.77.4: latestAnnouncementId bumped to aug-2026-v3.77.4-cloud-semble-custom-modes in ClineProvider.ts, English content rewritten (cloud services removed + stability, Semble/code-index reliability, custom modes upgrade) without <bold> tags, and the same highlights + simplified support line propagated to all 17 locale chat.json files. Dead announcement.cloudAgents.* blocks removed from all 18 locales. Open VSX branding asset added for the banner.

🐛 Bug Fixes

• Marketplace no longer strands on the infinite loader (Closes: #158) — MarketplaceView.tsx now applies a bounded retry (10s delay, max 3 attempts) that re-posts fetchMarketplaceData only while isFetching && no items; a legitimate empty response is never retried and the timer is cleared on success/unmount.
• Marketplace protocol drift fails loudly at the webview boundary (Closes: #158) — fetchMarketplaceData + filterMarketplaceItems are now registered as typed zod schemas in the webview message registry (untyped message count 149 → 147), mirroring the exact sender shapes.
• Extension-host messages accepted in remote/server webviews (Closes: #152) — isTrustedMessage() now trusts purely by ORIGIN (origin === window.origin, a vscode-webview:// origin, or an empty/null origin). The earlier source-object check (null/window/parent/top) caused false rejections on VSCodium Desktop + Remote-SSH, where the extension host forwards messages through an intermediate same-origin Window — silently dropping codeIndexSettingsSaved, indexingStatusUpdate, and others (code-index Save hung on saving, workspace toggle untickable, status badge stuck). Origin is the complete security boundary: cross-origin senders cannot spoof MessageEvent.origin.

✅ Quality

• Regression coverage — trustedMessages.spec.ts covers the exact "different same-origin Window" regression case; cross-origin rejection cases retained (13/13 pass). Marketplace retry specs added (no-retry-on-success, retry-while-fetching, max-attempts). Marketplace message schema boundary tests added.

🔧 Chores

• CI: branch references corrected from main to master — code-qa.yml, nightly-publish.yml, marketplace-publish.yml, codeql.yml, and label-pr-review-state.yml referenced the main branch, but this fork's trunk is master — so push-triggered CI and manual dispatches never fired. All branch references updated to master; the release command (release.md) PR base updated to match.
• CI: fixed secrets-in-if: workflow parse error (unblocks publishing) — marketplace-publish.yml and nightly-publish.yml used the secrets context inside if: expressions, which GitHub Actions rejects at parse time — every publish run since v3.69.2 failed before any job started (extension stuck on 3.72.0 at Open VSX). Marketplace tokens are now exposed as job-level env and gated via if: env.* != ''.
• Updated CHANGELOG.md and synced to src/CHANGELOG.md

Roo+ v3.72.0

[3.72.0] — 2026-07-20

Minor — Custom Modes Library, New Providers, UX Enhancements

🎯 Custom Modes Library (90 Specialized Agents)

Roo+ now ships with 90 carefully curated AI agents pre-loaded, selected from a library of 233 total specialized agents. 147 modes are seeded on first activation for instant access. The Mode Marketplace in the webview UI makes discovering and installing additional agents a one-click experience.

🤖 New LLM Providers

• Kenari — Added as a first-class provider
• Grok 4.5 — Full support with xAI reasoning format fixes

🧠 Smarter Task Management

• Condense Button — Collapsed task header shows context usage
• Task History Locking — invalidate() / invalidateAll() through withLock
• Terminal Reliability — Fixed output loss on cold terminals

🎨 UI Polish

• Diff Tab Re-branding — "Roo+"s Changes" in all diff tab labels
• API Enhancement — CompletePromptOptions parameter added
• Vision Support — Image attach when model supports vision

🔒 Stability & Quality

• Regression Tests — Full coverage for interrupted subtask parent-link (issue Zoo-Code-Org#566)
• 20+ dependency updates across frontend, AI SDKs, infrastructure

💙 Love Roo+? Consider leaving a review on the Open VSX Registry or giving us a ⭐ on GitHub.